build: add govulncheck and golangci-lint CI jobs, bump Go to 1.26.9

.github/workflows/ci.yml

@@ -19,10 +19,32 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.26.4"
+          go-version: "1.26.9"
           cache: true
       - run: go build ./...
       - run: go vet ./...
       - run: go test ./... -count=1 -race -coverprofile=coverage.out
       - name: Coverage summary
         run: go tool cover -func=coverage.out | tail -1
+
+  govulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.26.9"
+          cache: true
+      - run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.26.9"
+          cache: true
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.15.0

.golangci.yml

@@ -0,0 +1,26 @@
+version: "2"
+
+linters:
+  default: none
+  enable:
+    - govet
+    - staticcheck
+    - ineffassign
+    - errcheck
+  settings:
+    errcheck:
+      # Best-effort cleanup on error/shutdown paths, where there is no
+      # caller to report to; checked closes on the happy path stay checked.
+      exclude-functions:
+        - (*os.File).Close
+        - (io.Closer).Close
+        - (*github.com/shaikn6/lethe/internal/memory.journal).close
+        - (github.com/shaikn6/lethe/internal/memory.journalFile).Close
+        - os.Remove
+        - (*encoding/json.Encoder).Encode
+  exclusions:
+    rules:
+      # Test setup/teardown does not need every return value checked.
+      - path: _test\.go
+        linters:
+          - errcheck

go.mod

@@ -1,6 +1,6 @@
 module github.com/shaikn6/lethe
 
-go 1.26.4
+go 1.26.9
 
 require github.com/twmb/franz-go v1.22.1